Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/602—Providing cryptographic facilities or services
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
  • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party

Definitions

• the present invention relates to communication networks implementing a chain of blocks (or "Blockchain”), and more specifically to access to a service using such a chain of blocks.
• Blockchain a chain of blocks
• a blockchain is a technology implemented in a peer-to-peer network to transmit and store information contained in blocks without a control body. Each block is added to the other blocks of the same chain after a consensus between peers, that is to say after each peer (or network node) has verified and then validated it.
• a block after validation and verification, is added to an existing chain, it stores "in it” a digital fingerprint (or "hash") used to identify the block previously added to this chain of blocks from an initial piece of data, in order to establish the link that connects it to the rest of the blockchain. It is thus possible to carry out secure, irrefutable and long-lasting exchanges in a chain of blocks, which makes it possible to obtain a decentralized network (i.e. without a control body), transparent, secure, reliable and anonymous.
• Hyperledger Fabric private and allowing to delimit roles between peers (or nodes), to offer consensus services and decentralized applications, and to program smart contracts (or “chaincodes” - programs capable of carrying out several types of transactions with each other), “Ethereum” (public) and “Bitcoin” (public).
• peer nodes In a network implementing a Hyperledger Fabric-type blockchain, peer nodes (or “peer nodes”) coexist that execute smart contracts (or chaincodes), access ledger data, approve transactions and act as intermediaries with third parties. applications or services, and author nodes (or “orderer nodes”) that ensure blockchain consistency and deliver approved transactions to network peers and membership service providers (or MSPs (“Managed Service Providers”) - certificate authorities managing the X.509 certificates used to authenticate member identities and roles).
• smart contracts or chaincodes
• access ledger data approve transactions and act as intermediaries with third parties.
• applications or services and author nodes (or “orderer nodes”) that ensure blockchain consistency and deliver approved transactions to network peers and membership service providers (or MSPs (“Managed Service Providers”) - certificate authorities managing the X.509 certificates used to authenticate member identities and roles).
• MSPs Managed Service Providers
• the invention relates more specifically to methods for accessing a chain of blocks from a user identity provided by an identity provider (or "Identity Provider").
• the invention is intended to exploit the context of a client (or user) to allow the latter to access a chain of blocks, implemented in a communication network, from an authentication of this user and without storing the aforementioned data.
• the control method according to the invention may comprise other characteristics which may be taken separately or in combination, and in particular: - In its step, the first communication device can connect to a second communication device responsible for carrying out the authentication; - in its step, you can initialize a cryptographic random generator (for example of the chacha20 type) with secret information and the user identifier in order to obtain a random number, then you can generate the pair of cryptographic keys from this obtained random; - in the presence of the previous option, in its step, before initialization, when the secret information has a size greater than a predefined size, this secret information can be compressed (for example by means of a cryptographic hash function) so that it has this predefined size; - in its step the user can provide the first service with the pair of generated cryptographic keys, one of which is a certificate representing a certified public key, in order to access the first service.
• a cryptographic random generator for example of the chacha20 type
• the invention also proposes a computer program downloadable from a communication network and/or recorded on a computer-readable medium and/or executable by at least one processor.
• This computer program is characterized in that it comprises instructions for the execution of the steps of a control method of the type presented above, when it is executed on at least one processor-based device ( s) or at least one computer.
• the invention also proposes a control device intended to control access to a first service using a chain of blocks implemented in a communication network.
• the aim of the invention is in particular to propose a control method, and an associated control device 1, intended to allow the control of a user's access to a first service using a chain of blocks (or blockchain) implemented works in a communication network 2 comprising nodes 3-j.
• This communication equipment can be mobile smart phones (or “smartphones”), electronic tablets, servers, or computers (desktop or portable), for example.
• a node 3-j is also a communication device, but belonging to the communication network 2.
• the communication equipment 4 is a mobile smart phone belonging to a user, client of the chain of blocks implemented in the communication network 2 and used by at least a first service, and comprising at least a part of a control device 1 according to the invention, to which we will return later.
• the control method, according to the invention, is implemented when this user wishes to access this first service via his communication equipment 4.
• control device 1 is distributed in the communication equipment 4 and in another communication equipment 13 providing an intermediate service (for example a web service).
• the communication equipment 4 can ensure the man/machine interface towards this intermediate service which is responsible for carrying out all the operations allowing access to the first service.
• a control method according to the invention comprises a step 100-140 which can be implemented at least partially by a control device 1 according to the invention or else by a dedicated computer program executed on at least one piece of equipment to processor(s) or at least one computer.
• This dedicated computer program includes instructions for executing the steps of the control method and can be downloaded from a communication network and/or recorded on a computer-readable medium and/or executable by at least one processor (or a unit processing) of equipment (here at least the communication equipment 4).
• the aforementioned step 100-140 first of all comprises a sub-step 100 in which the user accesses, by means of his communication equipment 4 (and via the optional communication equipment 13), a second service which is responsible for generating cryptographic key pairs.
• the aforementioned step 100-140 then comprises a sub-step 110 in which the user uses this second service to connect to a first communication device 5 which belongs to an identity provider, in order to be authenticated.
• this first communication device 5 can be a server, accessible via the communication network 2.
• the authentication of the user can be done conventionally by providing the latter with his identifier (or "login”) and/or his password (or "password”), for example.
• the step 100-140 then comprises a sub-step 120 in which the first communication equipment 5 provides the user, via the second service, with a user identifier (or "subject identify"), which identifies it in a unique and stable way over time.
• a user identifier or "subject identify”
• Step 100-140 then includes a sub-step 130 in which the second service uses the user identifier (provided in sub-step 120) to generate a pair of cryptographic keys which it transmits to the user ( and more precisely to its communication equipment 4).
• Step 100-140 finally includes a sub-step 140 in which the user uses (by means of his communication equipment 4 and via a node 3-1) the pair of cryptographic keys (generated in sub-step 130) in order to access the first service to use the blockchain.
• the first communication device 5 can connect to a second communication device 6 responsible for carrying out the authentication.
• the identity provider delegates user authentication to an external company (public or private) which is authorized (or entitled) to do so and which owns the second communication equipment 6.
• this second equipment communication device 6 can be a server accessible via a communication network 14.
• the delegation of authentication to an external company requires that the first communication device 5 has an application programming interface (or API ("Application Programming Interface")) which is for example "OpenId Connect" compatible.
• one can begin by initializing a cryptographic random generator with secret information (or a secret) and the user id in order to get a random one. Then, we (the second service) can generate the pair of cryptographic keys from this random obtained.
• This particular method of generating cryptographic keys makes it possible to advantageously guarantee that the latter are deterministic, and therefore that the keys are the same each time for a user and the same certificate (possibility of carrying out certain cryptographic operations because the keys are not ephemera).
• the cryptographic random generator can be of the chacha20 type. It is recalled that chacha20 uses both a key and a nonce.
• the aforementioned key can be a common key (i.e. used for all users), and the nonce can be derived from the data of the user by the compression process (as for the secret that we compress (for example with sha256)).
• cryptographic random generator can be used, including HC-128, Rabbit, Salsa20/12, SOSEMANUK and Trivium.
• step 100-140 when the secret information (or secret) has a size which is greater than a predefined size on (the second service) can compress this secret information so that it has this predefined size.
• this secret information is the compressed secret information which is used to initialize the cryptographic random generator.
• one can compress the secret information using a cryptographic hash function.
• this cryptographic hash function can be SHA256, BLAKE-256, Keccak, Whirlpool, or MD6.
• the cryptographic keys can be of the Secp256k1 type, for example.
• the blockchain is private, as is for example the case of Hyperledger Fabric, the access of the user to the first service requires the provision by this user of a pair of cryptographic keys, whose l 'une is a certificate representative of a public key certified in sub-step 130.
• the cryptographic keys can be of the P-256 type, for example.
• the public key must be certified by a certification authority (or MSP (Membership Service Provider)). Consequently, to create a communication network 2 carrying the chain of blocks, one must have at least one certification authority (or MSP) using within this communication network 2 a membership system based on x.509 certificates and the elliptical curve P-256, such as "Fabric-CA", and an administrator account of this certification authority (or MSP) which is used to register users. It will be noted that it is the first communication device 5 which makes a request to an API of the MSP (for example Fabric-CA) to obtain the certificate, from the public key for the user.
• MSP Membership Service Provider
• the first communication equipment 5 does another request to the MSP API (e.g. Fabric-CA) to generate a certificate for the user.
• the first communication equipment 5 then returns to the user's communication equipment 4 the two cryptographic keys, one of which is the certificate (which contains the certified public key)), for example encoded in PEM ("Privacy Enhanced Email”).
• PEM Primary Enhanced Email
• the second service used must be constant in its generation algorithm and over time, in order to regenerate the same keys for the same user.
• the control device 1 comprises at least one processing unit 7 and at least one memory 8 capable of carrying out the operations consisting, in the event of user access, via a node (here 3-1), of the second service , to control the use of this second service so that it connects to the first communication equipment 5 belonging to the identity provider in order to request the authentication of the user, and, in the event of authentication, that it provides a user identifier, which identifies the user in a unique and stable manner over time, then to trigger the use of this user identifier by the second service so that the latter generates a pair of cryptographic keys, then to controlling the provision of at least this pair to the first service for the user to access the latter.
• a node here 3-1
• the second service capable of carrying out the operations consisting, in the event of user access, via a node (here 3-1), of the second service , to control the use of this second service so that it connects to the first communication equipment 5 belonging to the identity provider in order to request the authentication of the user, and, in the
• the processing unit 7 can, for example, be a processor, possibly a digital signal processor (or DSP (“Digital Signal Processor”)).
• Memory 8 stores data files and computer program(s) whose instructions are intended to be executed by processing unit 7 (or processor).
• This memory 8 can, for example, be of the RAM (“Random Access Memory”) type.
• This processing unit 7 and this memory 8 are arranged to perform together the operations contributing in particular to the control of access to the first service.
• the control device 1 is arranged in the form of a computer equipping the communication equipment 4 of the user and the communication equipment 13 (providing the intermediate service). But the control device 1 could be part of one or more computers ensuring at least one other function within the communication equipment 4 and/or the communication equipment 13.
• the computer 1 can also comprise an input interface 9 for receiving at least the username/password of the user, the cryptographic keys to use them in calculations or processing, possibly after having formatted them and/or demodulated and/or amplified, in a manner known per se, by means of a digital signal processor 10.
• this computer 1 can also comprise an output interface 11, in particular to provide requests and the identifier/password of the user to the second service and the cryptographic keys to the first service, and/or a mass memory 12.
• the computer 1 can be made in the form of a combination of electrical or electronic circuits or components (or “hardware”), possibly micro-programmed or micro-wired, and software modules (or “software”).

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Hardware Design (AREA)
• Theoretical Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Bioethics (AREA)
• Signal Processing (AREA)
• Health & Medical Sciences (AREA)
• Computer Networks & Wireless Communication (AREA)
• General Health & Medical Sciences (AREA)
• Software Systems (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Computing Systems (AREA)
• Telephonic Communication Services (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Computer And Data Communications (AREA)
• Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Applications Claiming Priority (2)

Publications (3)

Family

ID=75438942

Family Applications (1)

Country Status (4)

Families Citing this family (3)

Family Cites Families (2)

• 2020
  • 2020-12-23 FR FR2014097A patent/FR3118226B1/fr active Active
• 2021
  • 2021-12-23 EP EP21845104.5A patent/EP4268109B1/de active Active
  • 2021-12-23 WO PCT/IB2021/062239 patent/WO2022137192A1/fr not_active Ceased
  • 2021-12-23 ES ES21845104T patent/ES3058980T3/es active Active

Also Published As

Similar Documents

Legal Events